EnCE Legal Procedures 4 — Questions and Answers
Question 1: What is the significance of a 'Daubert' hearing in the context of digital forensic testimony?
- It determines whether a witness can plead the Fifth Amendment
- It is a pre-trial hearing where a judge evaluates whether expert testimony meets scientific reliability standards (Correct answer)
- It establishes the chain of custody for digital evidence
- It is a hearing to suppress unlawfully obtained evidence
Correct answer: It is a pre-trial hearing where a judge evaluates whether expert testimony meets scientific reliability standards
Under Daubert v. Merrell Dow Pharmaceuticals, federal judges act as gatekeepers to assess whether expert testimony is based on sufficient facts and reliable methodology.
Question 2: An examiner is analyzing a corporate laptop under a consent agreement that limits the search to 'financial records.' The examiner discovers child exploitation images. What is the appropriate action?
- Ignore the images because they are outside the scope of consent
- Continue searching the entire device because child exploitation is more serious
- Stop the search, preserve findings, and notify law enforcement to obtain proper legal authority (Correct answer)
- Delete the images and report only the financial findings
Correct answer: Stop the search, preserve findings, and notify law enforcement to obtain proper legal authority
When evidence outside the scope of consent is discovered, the examiner should stop, preserve the findings, and allow law enforcement to obtain a warrant for the new evidence.
Question 3: What does 'hearsay' mean in the context of digital evidence, and which exception most commonly applies to business records?
- Hearsay is out-of-court testimony; business records fall under FRE 803(6) (Correct answer)
- Hearsay is any electronic data; business records require authentication under FRE 901
- Hearsay is evidence from third parties; business records require a subpoena
- Hearsay is deleted data; business records are admissible under FRE 702
Correct answer: Hearsay is out-of-court testimony; business records fall under FRE 803(6)
Hearsay is an out-of-court statement offered for the truth of the matter asserted; the business records exception under FRE 803(6) allows regularly kept records into evidence.
Question 4: Which federal statute primarily governs unauthorized access to computer systems and is commonly used in prosecuting computer intrusion cases?
- Electronic Communications Privacy Act (ECPA)
- Digital Millennium Copyright Act (DMCA)
- Computer Fraud and Abuse Act (CFAA) (Correct answer)
- Gramm-Leach-Bliley Act (GLBA)
Correct answer: Computer Fraud and Abuse Act (CFAA)
The Computer Fraud and Abuse Act (18 U.S.C. § 1030) is the primary federal law criminalizing unauthorized access to computers and related offenses.
Question 5: What is the purpose of a 'preservation letter' sent to a third-party service provider during an investigation?
- To compel immediate production of records under penalty of contempt
- To request voluntary preservation of specified records pending formal legal process (Correct answer)
- To notify the provider that a subpoena has been filed with the court
- To transfer jurisdiction over the investigation to the provider's home state
Correct answer: To request voluntary preservation of specified records pending formal legal process
A preservation letter requests that a provider voluntarily preserve specified data while formal legal process (subpoena or warrant) is being obtained.
Question 6: In the United States, the 'good faith exception' to the exclusionary rule allows evidence to be admitted when:
- Officers acted in reasonable reliance on a warrant later found to be defective (Correct answer)
- Officers believed the suspect was guilty based on prior criminal history
- The evidence was discovered by a civilian informant
- Officers conducted a search within 48 hours of obtaining probable cause
Correct answer: Officers acted in reasonable reliance on a warrant later found to be defective
The good faith exception established in United States v. Leon allows evidence obtained by officers who reasonably relied on a facially valid but ultimately defective warrant.
Question 7: Which principle requires that digital forensic examiners document their methods so completely that another qualified examiner could reproduce the same results?
- Peer review
- Reproducibility (Correct answer)
- Chain of custody
- Non-repudiation
Correct answer: Reproducibility
Reproducibility is a foundational scientific principle requiring that forensic methods be documented well enough for another examiner to obtain the same results independently.
EnCE Legal Procedures 4
What is the significance of a 'Daubert' hearing in the context of digital forensic testimony?